Áreas de trabajo de Microsoft.OperationalInsights/tables 2020-10-01

Definición de recursos de Bicep

El tipo de recurso workspaces/tables se puede implementar con operaciones destinadas a:

Para obtener una lista de las propiedades modificadas en cada versión de API, consulte registro de cambios.

Formato de recurso

Para crear un recurso Microsoft.OperationalInsights/workspaces/tables, agregue el siguiente bicep a la plantilla.

resource symbolicname 'Microsoft.OperationalInsights/workspaces/tables@2020-10-01' = {
  parent: resourceSymbolicName
  name: 'string'
}

Valores de propiedad

Microsoft.OperationalInsights/workspaces/tables

Nombre Descripción Importancia
nombre El nombre del recurso string (obligatorio)
padre En Bicep, puede especificar el recurso primario para un recurso secundario. Solo tiene que agregar esta propiedad cuando el recurso secundario se declara fuera del recurso primario.

Para obtener más información, consulte recurso secundario fuera del recurso primario.		 Nombre simbólico del recurso de tipo: áreas de trabajo

Ejemplos de uso

Ejemplos de Bicep

Un ejemplo de registro de auditoría de la implementación de tablas de áreas de trabajo de Operational Insights.

param resourceName string = 'acctest0001'
param location string = 'westeurope'

var auditLogTableName = 'AuditLog_CL'
var auditLogColumns = [
  {
    name: 'appId'
    type: 'string'
  }
  {
    name: 'correlationId'
    type: 'string'
  }
  {
    name: 'TimeGenerated'
    type: 'datetime'
  }
]

resource workspace 'Microsoft.OperationalInsights/workspaces@2022-10-01' = {
  name: resourceName
  location: location
  properties: {
    features: {
      disableLocalAuth: false
      enableLogAccessUsingOnlyResourcePermissions: true
    }
    publicNetworkAccessForIngestion: 'Enabled'
    publicNetworkAccessForQuery: 'Enabled'
    retentionInDays: 30
    sku: {
      name: 'PerGB2018'
    }
    workspaceCapping: {
      dailyQuotaGb: -1
    }
  }
}

resource table 'Microsoft.OperationalInsights/workspaces/tables@2022-10-01' = {
  name: auditLogTableName
  parent: workspace
  properties: {
    schema: {
      columns: auditLogColumns
      name: auditLogTableName
    }
  }
}

Un ejemplo básico de implementación de tablas de áreas de trabajo de Operational Insights.

param resourceName string = 'acctest0001'
param location string = 'westeurope'

var sentinelTiAlertsTableName = 'SentinelTIAlerts_CL'
var sentinelTiAlertsColumns = [
  {
    name: 'ConfidenceScore'
    type: 'int'
  }
  {
    type: 'string'
    name: 'ExternalIndicatorId'
  }
  {
    name: 'IndicatorType'
    type: 'string'
  }
  {
    name: 'Indicator'
    type: 'string'
  }
  {
    name: 'TimeGenerated'
    type: 'datetime'
  }
  {
    name: 'MatchType'
    type: 'string'
  }
  {
    name: 'OriginTimestamp'
    type: 'datetime'
  }
  {
    name: 'Details'
    type: 'dynamic'
  }
]

resource workspace 'Microsoft.OperationalInsights/workspaces@2022-10-01' = {
  name: resourceName
  location: location
  properties: {
    features: {
      disableLocalAuth: false
      enableLogAccessUsingOnlyResourcePermissions: true
    }
    publicNetworkAccessForIngestion: 'Enabled'
    publicNetworkAccessForQuery: 'Enabled'
    retentionInDays: 30
    sku: {
      name: 'PerGB2018'
    }
    workspaceCapping: {
      dailyQuotaGb: -1
    }
  }
}

resource table 'Microsoft.OperationalInsights/workspaces/tables@2022-10-01' = {
  name: sentinelTiAlertsTableName
  parent: workspace
  properties: {
    retentionInDays: 30
    schema: {
      columns: sentinelTiAlertsColumns
      name: sentinelTiAlertsTableName
    }
    totalRetentionInDays: 30
  }
}

Un ejemplo de datacollectionlogs de implementación de tablas de áreas de trabajo de Operational Insights.

param location string = 'westeurope'
param resourceName string = 'acctest0001'

var dataCollectionLogColumns = [
  {
    name: 'RawData'
    type: 'string'
  }
  {
    type: 'string'
    name: 'FilePath'
  }
  {
    type: 'datetime'
    name: 'TimeGenerated'
  }
]
var dataCollectionLogTableName = 'DataCollectionLog_CL'

resource workspace 'Microsoft.OperationalInsights/workspaces@2022-10-01' = {
  name: resourceName
  location: location
  properties: {
    features: {
      disableLocalAuth: false
      enableLogAccessUsingOnlyResourcePermissions: true
    }
    publicNetworkAccessForIngestion: 'Enabled'
    publicNetworkAccessForQuery: 'Enabled'
    retentionInDays: 30
    sku: {
      name: 'PerGB2018'
    }
    workspaceCapping: {
      dailyQuotaGb: -1
    }
  }
}

resource table 'Microsoft.OperationalInsights/workspaces/tables@2022-10-01' = {
  name: dataCollectionLogTableName
  parent: workspace
  properties: {
    schema: {
      columns: dataCollectionLogColumns
      name: dataCollectionLogTableName
    }
  }
}

Definición de recursos de plantilla de ARM

El tipo de recurso workspaces/tables se puede implementar con operaciones destinadas a:

Para obtener una lista de las propiedades modificadas en cada versión de API, consulte registro de cambios.

Formato de recurso

Para crear un recurso Microsoft.OperationalInsights/workspaces/tables, agregue el siguiente JSON a la plantilla.

{
  "type": "Microsoft.OperationalInsights/workspaces/tables",
  "apiVersion": "2020-10-01",
  "name": "string"
}

Valores de propiedad

Microsoft.OperationalInsights/workspaces/tables

Nombre Descripción Importancia
apiVersion La versión de api '2020-10-01'
nombre El nombre del recurso string (obligatorio)
tipo El tipo de recurso "Microsoft.OperationalInsights/workspaces/tables"

Ejemplos de uso

Definición de recursos de Terraform (proveedor AzAPI)

El tipo de recurso workspaces/tables se puede implementar con operaciones destinadas a:

Para obtener una lista de las propiedades modificadas en cada versión de API, consulte registro de cambios.

Formato de recurso

Para crear un recurso Microsoft.OperationalInsights/workspaces/tables, agregue el siguiente terraform a la plantilla.

resource "azapi_resource" "symbolicname" {
  type = "Microsoft.OperationalInsights/workspaces/tables@2020-10-01"
  name = "string"
  parent_id = "string"
}

Valores de propiedad

Microsoft.OperationalInsights/workspaces/tables

Nombre Descripción Importancia
nombre El nombre del recurso string (obligatorio)
parent_id Identificador del recurso que es el elemento primario de este recurso. Identificador del recurso de tipo: áreas de trabajo
tipo El tipo de recurso "Microsoft.OperationalInsights/workspaces/tables@2020-10-01"

Ejemplos de uso

Ejemplos de Terraform

Un ejemplo de registro de auditoría de la implementación de tablas de áreas de trabajo de Operational Insights.

terraform {
  required_providers {
    azapi = {
      source = "Azure/azapi"
    }
  }
}

provider "azapi" {
  skip_provider_registration = false
}

variable "resource_name" {
  type    = string
  default = "acctest0001"
}

variable "location" {
  type    = string
  default = "westeurope"
}

locals {
  audit_log_table_name = "AuditLog_CL"
  audit_log_columns = [
    {
      "name" : "appId",
      "type" : "string"
    },
    {
      "name" : "correlationId",
      "type" : "string"
    },
    {
      "name" : "TimeGenerated",
      "type" : "datetime"
    }
  ]
}

resource "azapi_resource" "resourceGroup" {
  type     = "Microsoft.Resources/resourceGroups@2020-06-01"
  name     = var.resource_name
  location = var.location
}

resource "azapi_resource" "workspace" {
  type      = "Microsoft.OperationalInsights/workspaces@2022-10-01"
  parent_id = azapi_resource.resourceGroup.id
  name      = var.resource_name
  location  = var.location
  body = {
    properties = {
      features = {
        disableLocalAuth                            = false
        enableLogAccessUsingOnlyResourcePermissions = true
      }
      publicNetworkAccessForIngestion = "Enabled"
      publicNetworkAccessForQuery     = "Enabled"
      retentionInDays                 = 30
      sku = {
        name = "PerGB2018"
      }
      workspaceCapping = {
        dailyQuotaGb = -1
      }
    }
  }
  schema_validation_enabled = false
  response_export_values    = ["*"]
}

resource "azapi_resource" "table" {
  type      = "Microsoft.OperationalInsights/workspaces/tables@2022-10-01"
  parent_id = azapi_resource.workspace.id
  name      = local.audit_log_table_name
  body = {
    properties = {
      schema = {
        name    = local.audit_log_table_name
        columns = local.audit_log_columns
      }
    }
  }
  schema_validation_enabled = false
  response_export_values    = ["*"]
}

Un ejemplo básico de implementación de tablas de áreas de trabajo de Operational Insights.

terraform {
  required_providers {
    azapi = {
      source = "Azure/azapi"
    }
  }
}

provider "azapi" {
  skip_provider_registration = false
}

variable "resource_name" {
  type    = string
  default = "acctest0001"
}

variable "location" {
  type    = string
  default = "westeurope"
}

locals {
  sentinel_ti_alerts_table_name = "SentinelTIAlerts_CL"
  sentinel_ti_alerts_columns = [
    {
      "name" : "ConfidenceScore",
      "type" : "int"
    },
    {
      "name" : "ExternalIndicatorId",
      "type" : "string"
    },
    {
      "name" : "IndicatorType",
      "type" : "string"
    },
    {
      "name" : "Indicator",
      "type" : "string"
    },
    {
      "name" : "TimeGenerated",
      "type" : "datetime"
    },
    {
      "name" : "MatchType",
      "type" : "string"
    },
    {
      "name" : "OriginTimestamp",
      "type" : "datetime"
    },
    {
      "name" : "Details",
      "type" : "dynamic"
    }
  ]
}

resource "azapi_resource" "resourceGroup" {
  type     = "Microsoft.Resources/resourceGroups@2020-06-01"
  name     = var.resource_name
  location = var.location
}

resource "azapi_resource" "workspace" {
  type      = "Microsoft.OperationalInsights/workspaces@2022-10-01"
  parent_id = azapi_resource.resourceGroup.id
  name      = var.resource_name
  location  = var.location
  body = {
    properties = {
      features = {
        disableLocalAuth                            = false
        enableLogAccessUsingOnlyResourcePermissions = true
      }
      publicNetworkAccessForIngestion = "Enabled"
      publicNetworkAccessForQuery     = "Enabled"
      retentionInDays                 = 30
      sku = {
        name = "PerGB2018"
      }
      workspaceCapping = {
        dailyQuotaGb = -1
      }
    }
  }
  schema_validation_enabled = false
  response_export_values    = ["*"]
}

resource "azapi_resource" "table" {
  type      = "Microsoft.OperationalInsights/workspaces/tables@2022-10-01"
  parent_id = azapi_resource.workspace.id
  name      = local.sentinel_ti_alerts_table_name
  body = {
    properties = {
      schema = {
        name    = local.sentinel_ti_alerts_table_name
        columns = local.sentinel_ti_alerts_columns
      }
      retentionInDays      = 30
      totalRetentionInDays = 30
    }
  }
  schema_validation_enabled = false
  response_export_values    = ["*"]
}

Un ejemplo de datacollectionlogs de implementación de tablas de áreas de trabajo de Operational Insights.

terraform {
  required_providers {
    azapi = {
      source = "Azure/azapi"
    }
  }
}

provider "azapi" {
  skip_provider_registration = false
}

variable "resource_name" {
  type    = string
  default = "acctest0001"
}

variable "location" {
  type    = string
  default = "westeurope"
}

locals {
  data_collection_log_table_name = "DataCollectionLog_CL"
  data_collection_log_columns = [
    {
      "name" : "RawData",
      "type" : "string"
    },
    {
      "name" : "FilePath",
      "type" : "string"
    },
    {
      "name" : "TimeGenerated",
      "type" : "datetime"
    }
  ]
}

resource "azapi_resource" "resourceGroup" {
  type     = "Microsoft.Resources/resourceGroups@2020-06-01"
  name     = var.resource_name
  location = var.location
}

resource "azapi_resource" "workspace" {
  type      = "Microsoft.OperationalInsights/workspaces@2022-10-01"
  parent_id = azapi_resource.resourceGroup.id
  name      = var.resource_name
  location  = var.location
  body = {
    properties = {
      features = {
        disableLocalAuth                            = false
        enableLogAccessUsingOnlyResourcePermissions = true
      }
      publicNetworkAccessForIngestion = "Enabled"
      publicNetworkAccessForQuery     = "Enabled"
      retentionInDays                 = 30
      sku = {
        name = "PerGB2018"
      }
      workspaceCapping = {
        dailyQuotaGb = -1
      }
    }
  }
  schema_validation_enabled = false
  response_export_values    = ["*"]
}

resource "azapi_resource" "table" {
  type      = "Microsoft.OperationalInsights/workspaces/tables@2022-10-01"
  parent_id = azapi_resource.workspace.id
  name      = local.data_collection_log_table_name
  body = {
    properties = {
      schema = {
        name    = local.data_collection_log_table_name
        columns = local.data_collection_log_columns
      }
    }
  }
  schema_validation_enabled = false
  response_export_values    = ["*"]
}
  • Last updated on